CVE-2026-89238

A flaw was found in Apache WSS4J. A remote attacker can exploit an element confusion issue in encrypted header processing by sending a specially crafted message. This vulnerability causes the application to treat an attacker-controlled plaintext element as a decrypted header, potentially leading ...